Composer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-14675Highwpmetabox/meta-box: Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file CVE-2026-30885Mediumwwbn/avideo: AVideo has Unauthenticated IDOR - Playlist Information Disclosure GHSA-5Q8V-J673-M5V4Mediumgrumpydictator/firefly-iii: Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)CVE-2026-30838Mediumleague/commonmark: CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names CVE-2025-15602Highsnipe/snipe-it: Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment GHSA-7RHV-H82H-VPJHMediumec-cube/ec-cube: EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface GHSA-QRFH-CC86-VC8CMediumleantime/leantime: Leantime has HTML injection through firstname and lastname fields CVE-2026-29093Highwwbn/avideo: AVideo: Unauthenticated PHP session store exposed to host network via published memcached port CVE-2026-29069Highcraftcms/cms: Craft CMS has unauthenticated activation email trigger with potential user enumeration CVE-2026-28685Mediumkimai/kimai: Kimai's API invoice endpoint missing customer-level access control (IDOR)CVE-2026-3242Mediumconcrete5/concrete5: Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3241Mediumconcrete5/concrete5: Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-3240Mediumconcrete5/concrete5: Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-2994Lowconcrete5/concrete5: Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF)CVE-2026-3452Highconcrete5/concrete5: Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection CVE-2026-3244Mediumconcrete5/concrete5: Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability CVE-2026-28784Mediumcraftcms/cms: Craft CMS has potential authenticated Remote Code Execution via Twig SSTI CVE-2026-28782Mediumcraftcms/cms: Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action CVE-2026-28783Mediumcraftcms/cms: Craft CMS has Twig Function Blocklist Bypass CVE-2026-28781Mediumcraftcms/cms: Craft CMS: Entries Authorship Spoofing via Mass Assignment CVE-2026-28697Criticalcraftcms/cms: Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates GHSA-4MGV-366X-QXVXLowcraftcms/cms: Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options CVE-2026-28696Highcraftcms/cms: Craft CMS has IDOR via GraphQL @parseRefs CVE-2026-28695Mediumcraftcms/cms: Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget CVE-2026-29058Criticalwwbn/avideo: WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo